ThinstallVS v3104 Jitit Software

Hunt Hypothesis

This hypothesis targets the presence of Thinstall virtualized executables, a technique often used by adversaries to pack malware or legitimate tools to evade static analysis and signature-based detection. Proactively hunting for these specific Jitit Software artifacts in Azure Sentinel allows the SOC to identify potential fileless or packed payloads that may be executing on endpoints, ensuring early detection of stealthy threats before they can establish persistence or exfiltrate data.

YARA Rule

rule ThinstallVS_v3104_Jitit_Software: PEiD
{
    strings:
        $a = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB CC 1A 00 00 2B C3 50 68 00 00 ?? ?? 68 00 28 00 00 68 C8 00 00 00 E8 2C FF FF FF E9 90 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are specific false positive scenarios for the YARA rule ThinstallVS_v3104_Jitit_Software (Thinstall v3.10.4 by Jitit Software), along with suggested filters:

• Legacy Application Packaging for Virtual Desktop Infrastructure (VDI) or Citrix:

  • Scenario: IT administrators use Thinstall to package legacy Windows applications (e.g., old versions of Adobe Acrobat, specific ERP clients, or proprietary CAD tools) that lack modern installers or have compatibility issues in VDI/Citrix environments. The resulting executable is deployed via SCCM or Intune to user endpoints.
  • Filter/Exclusion: Exclude files located in specific application directories known to contain packaged apps (e.g., C:\Program Files\LegacyApps\, C:\Program Files (x86)\CitrixApps\) or exclude processes where the parent is a deployment agent (e.g., ccmsetup.exe, msiexec.exe) and the file hash matches a known baseline of approved Thinstall-packaged binaries.

• Scheduled Maintenance Jobs for Third-Party Utilities:

  • Scenario: A third-party utility (e.g., a disk defragmenter, log rotation tool, or backup agent component) is distributed as a Thinstall-packaged executable and is registered as a scheduled task in Task Scheduler to run daily or weekly. The YARA rule triggers on the static file scan of the executable in the Task Scheduler XML or when the process starts.
  • Filter/Exclusion: Exclude files with names matching known utility patterns (e.g., *maint*.exe, *cleanup*.exe) located in C:\ProgramData\ or C:\Windows\System32\ (if placed there by admin), or exclude processes where the parent is svchost.exe (Task Scheduler service) and the command